How to Check If Your Server Has Been Compromised

Signs your server may have been hacked and what to do about it.

Warning Signs

• Unexpected high CPU or network usage
• Unknown processes running
• Modified system files
• New user accounts you didn't create
• Unusual outbound network connections

Investigation Steps

# Check for unknown users
cat /etc/passwd | grep -v nologin | grep -v false

# Check for unknown SSH keys
cat ~/.ssh/authorized_keys

# Check running processes
ps auxf

# Check crontabs
crontab -l
ls -la /etc/cron.d/

# Check listening ports
ss -tulnp

# Check recent logins
last -20
lastb -20

If Compromised

1. Take the server offline (stop via portal)
2. Back up any important data you need
3. Rebuild the Breeze from scratch
4. Investigate how the breach occurred
5. Apply security hardening before going live